Service provided by the Federal Ministry of Justice and the Federal Office of Justice ‒ www.gesetze-im-internet.de Länder shall also be regarded as private bodies as defined in this Act if they take part in competition as enterprises governed by public law and carry out federal law, and if data protection is not governed by Land law. Chapter 2 Legal basis for processing personal data Section 3 Processing of personal data by public bodies Public bodies shall be permitted to process personal data if such processing is necessary to perform the task for which the controller is responsible or to exercise official authority which has been vested in the controller. Section 4 Video surveillance of publicly accessible spaces (1) Monitoring publicly accessible areas with optical-electronic devices (video surveillance) shall be permitted only as far as it is necessary 1. for public bodies to perform their tasks, 2. to exercise the right to determine who shall be allowed or denied access or 3. to safeguard legitimate interests for specifically defined purposes and if there is nothing to indicate legitimate overriding interests of the data subjects. For video surveillance of 1. large publicly accessible facilities, such as sport facilities, places of gathering and entertainment, shopping centres and car parks, or 2. vehicles and large publicly accessible facilities of public rail, ship or bus transport, protecting the lives, health and freedom of persons present shall be regarded as a very important interest. (2) Appropriate measures shall be taken to make the surveillance and the controller’s name and contact details identifiable as early as possible. (3) Storing or using data collected pursuant to subsection 1 shall be permitted if necessary to achieve the intended purpose and if there is nothing to indicate legitimate overriding interests of the data subjects. Subsection 1, second sentence, shall apply accordingly. The data may be further processed for another purpose only if necessary to prevent threats to state and public security and to prosecute crimes. (4) If data collected from video surveillance are attributed to a particular person, that person shall be informed of the processing in accordance with Articles 13 and 14 of Regulation (EU) 2016/679. Section 32 shall apply accordingly. (5) The data shall be deleted without delay, if they are no longer needed for the intended purpose or if the data subject's legitimate interests stand in the way of any further storage. Chapter 3 Data protection officers of public bodies Section 5 Designation (1) Public bodies shall designate a data protection officer. This shall also apply to public bodies as defined in Section 2 (5) which take part in competition. (2) A single data protection officer may be designated for several public bodies, taking account of their organizational structure and size. Page 3 of 43